https://seclists.org/oss-sec/2026/q4/90: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1

Q: Which deployments are exposed to this issue?

Only Zaqar deployments that use the WebSocket transport with Keystone authentication are affected. Deployments not using that combination are not identified as affected.

Q: What does an attacker need to exploit it?

The attacker must be authenticated remotely and know the UUID of the target project. They can then substitute that UUID in subsequent WebSocket frames.

Q: What access could an attacker obtain through exploitation?

An attacker may enumerate, inspect, create, or delete queues belonging to the target project. This can lead to unauthorized disclosure, modification, or loss of queue data.

Q: Which Zaqar versions are affected?

Affected versions are Zaqar 1.0.0 through before 20.1.3, 21.0.0 through before 21.0.3, 22.0.0 through before 22.0.3, and 23.0.0.

Published Oct 7, 2026

Updated

Affected Software

1 affected component

Openstack Zaqar>=1.0.0<20.1.3, >=21.0.0<21.0.3, >=22.0.0<22.0.3, =23.0.0

Frequently Asked Questions

Which deployments are exposed to this issue?

Only Zaqar deployments that use the WebSocket transport with Keystone authentication are affected. Deployments not using that combination are not identified as affected.

What does an attacker need to exploit it?

The attacker must be authenticated remotely and know the UUID of the target project. They can then substitute that UUID in subsequent WebSocket frames.

What access could an attacker obtain through exploitation?

An attacker may enumerate, inspect, create, or delete queues belonging to the target project. This can lead to unauthorized disclosure, modification, or loss of queue data.

Which Zaqar versions are affected?

Affected versions are Zaqar 1.0.0 through before 20.1.3, 21.0.0 through before 21.0.3, 22.0.0 through before 22.0.3, and 23.0.0.